Paralegal
Isabella Mahieu
GDPR, IT law, International Media Law
17 September 2019
Armin Karimi |
- Privacy
- IT law
Can an employer require use of fingerprint scanners?
Need advice? Please call or e-mail
Shoe retailer Manfield may not require employees to log in to the cash register system through fingerprint scanners. The Amsterdam District Court recently decided that. What are the rules for biometrics in the workplace?
Manfield had introduced fingerprint scan authorization for its cash register system in all stores. Previously, employees could log in via a personal code.
An employee has objected to the new system. However, Manfield considered the new system necessary to protect the customer data in the system and to prevent employees from opening the register with each other's personal code.
Fingerprint data is "biometric data" as meant in the General Data Protection Regulation (GDPR). In turn, biometric data is "special" personal data, just like for example race and health data. Processing of special personal data is prohibited unless an exception applies.
In addition to some exceptions in the GDPR itself (these were not applicable in the case at hand), the AVG also includes the option for Member States to make an exception when processing is necessary for "reasons of substantial public interest".
The Netherlands has made use of this option, specifically for biometric personal data. The Dutch implementation act to the GDPR states that the prohibition on processing biometric data does not apply if the processing is necessary for authentication or security purposes.
The judge ruled that Manfield cannot invoke this exception. Manfield has insufficiently investigated alternatives such as an access pass, employee pass and / or number codes, or a combination therof. In addition, it turned out that in the store where the employee worked, no form of security was implemented in any way (for example cameras, alarm gates and safes for staff). That naturally makes Manfield's position unconvincing.
Whether the exception applies in a specific case depends on the circumstances. It is of course more likely that a nuclear power plant will be able to rely on the exception rather than a store (such as Manfield).
The Manfield case shows that the use of biometrics must be carefully and demonstrably assessed. This assessment can be done, for example, in a Data Protection Impact Assessment (which is sometimes even mandatory).
Incidentally, simply asking personnel for permission to use their biometric data is probably not a solution. After all, permission must have been given freely. In view of the dependency relationship with the employer, employees are often not in a position to give permission freely.
Advice!
Do you want to use our knowledge and call us with some regularity? Subscribe to the Virtual Legal Department.
Interested? Call or email us:
T. +31(0)70-3819281
E. info@wisemen.nl
For the latest information, subscribe to the newsletter now
Archief
